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CLAIM AMENDMENTS 

This listing of claims will replace all prior versions and listings of claims in 

the application. 

1 1. (Currently Amended) A method of detecting denial of service (DoS) attacks in an 

2 Internet accessible network having at least one proxy server incorporating a session 

3 initiation protocol (SIP), said SIP including iiicommg INVITE messages that 

4 request set-up of an Internet telephone call and outgoing 180 Ringing messages 

5 that indicate ringing, the method comprising4he-fellowing stej»s: ■ 

6 aggregating said INVITE messages and said 180 Ringing messages for all 

7 users on said Internet accessible network; 

8 detecting an imbalance between a number of said INVITE and 180 Ringing 

9 messages resulting from a DoS attack; and 

10 j providing an indication of the-a presence of a current DoS attack on said 

11 proxy server based on detection of said imbalance. 

1 2. (Currently Amended) The method of claim 1, 

2 wherein a number (H) of INVITE messages including credentials that are 

3 sent from a user client in response to an authentication required message from the 

4 proxy server, said credentials being information used by the proxy server to 
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authenticate the INVITE messages, are removed from t'h- an accounting before the 

is tested such that when iiMi---im equation: 

INVo [[to]] + INVc - H = N180 

where INVo is t^fee-a number of INVITE messages without said credentials, 
INVc is number of IN\''ITE messages with said credentials, and 
N180 is ; : number of said 180 Ringiiig messages, 
is not true within a predetermined margin of error, 

then the presence of « -said current DoS attack on the proxy server is indicated by 
tfee-an. inequality in said equation . 

3. (Currently Amended) The method of claim 2, further com| >ri s i. n g---mi4HdiBg 

eiitaaB-g^-saM^ a call information table at 

said pro xy serve r for determining the-a. value of H. 

4. (Canceled) 

5. (Currently Amended) A system for detecting denial of service (DoS) attacks 
against session initiation protocol elements in a- an Internet accessible network 
having at least one proxy server, said system comprising: 
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means for aggregating INVITE messages and ■ .^ing 

180 Ringing messages for all users on said Internet accessible network; and 

means, within said proxy server, for determining if tfee a number of said 
INVITE messages including credentials (INVc) sent to said proxy server from user 
clients in response to an authentication requirement exceeds a number of said 180 
Ringing messages that indicates a DoS attack, said credentials being information 
used by the proxy server to authenticate the INVITE messages. 

6. (Currently Amended) A system for detecting denial of service (DoS) attacks 
in an Internet accessible network having at least one proxy server incorporating a 
session initiation protocol (SIP), said system comprising: 

means for aggregating .•.aiJ ian i a ing. INVITE messages and ga-td-()utgoi.ng 
180 Ringing messages for all users on said Internet accessible network; and 

means, within said proxy server, for detecting an imbalance between a 
number of said INVITE and said 180 Ringing messages, the imbalance indicating 
Ae-iLpresence of a current DoS attack on said proxy server. 

7. (Previously Presented) The system of claim 5, wherein said means for 
determining creates a call-info table for use in tracking said INVITE messages. 



1 8. (Currently Amended) The system of claim 6, wherein said means for 

2 detecting creates a call-info table for use m. tracking sai.d INVITE messages . 
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